Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, whould one expect there to be an endpoint for requesting an access-token? Or should we simply not provide an endpoint for that, and "expect" (with some instructions to our users) that the user requests an access token directly from the ADFS-server?.. whats the common pattern/flow? Since both our API and the ADFS-server is connected to the same domain, we are currently using Single sign on (not sure if that matters, but just providing that information in case it would).
Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
Anybody can answer
The best answers are voted up and rise to the top
